Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2019-3777

Apps Manager unverified SSL certs in Cloud Controller proxy

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
dell

Description

Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controller proxy that fails to verify SSL certs. A remote unauthenticated attacker that could hijack the Cloud Controller's DNS record could intercept access tokens sent to the Cloud Controller, giving the attacker access to the user's resources in the Cloud Controller

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Pivotal Apps Manager

  • 666 to < 666.0.19affected
  • 665 to < 665.0.26affected
  • 667 to < 667.0.5affected

Pivotal Pivotal Application Service

  • 2.4 to < 2.4.3affected
  • 2.3 to < 2.3.7affected
  • 2.2 to < 2.2.12affected

References